Data Policy

1. Roles and Responsibilities

2. Categories of Data Processed

• Identity and contact data of the Customer’s staff and end-customers
• Transaction and sales data
• Inventory and product data
• Invoicing and payment records
• System logs and audit trails

3. Processing by Nethub

3.1 As Data Processor

We process Customer Data solely to provide, maintain, and support the Tawala Service in accordance with the Customer’s instructions and configuration.

3.2 As Data Controller (Secondary Uses)

Nethub also processes data for the following legitimate purposes:

• Improving, securing, and developing the Tawala platform (including through artificial intelligence and machine learning)
• Generating aggregated and anonymised statistics and benchmarks
• Identifying and facilitating relevant business opportunities between customers and vetted third-party suppliers or wholesalers using anonymised or aggregated insights

In all such cases:

• We do not sell Personal Identifiable Information (PII)
• We apply appropriate safeguards, including anonymisation and aggregation where feasible
• We process data in accordance with the Kenya Data Protection Act, 2019

4. Data Security

We implement appropriate technical and organisational security measures, including:

• Encryption of data in transit
• Hashed and salted storage of passwords and PINs
• Role-based access controls
• Audit logging of sensitive actions
• Regular security assessments and backups

5. Sub-processors

We engage sub-processors (such as cloud hosting providers and payment processors) to support the Service. We remain responsible for their compliance with applicable data protection obligations. A current list of sub-processors is available upon request.

6. Data Subject Rights

Where a data subject exercises rights under the Data Protection Act, the Customer (as Data Controller) is primarily responsible for responding. Nethub will provide reasonable assistance to the Customer in fulfilling such requests.

7. Data Retention and Deletion

• Active data is retained for the duration of the Customer’s subscription
• Upon termination, Customer Data will be available for export for thirty (30) days
• Thereafter, personal data will be deleted or irreversibly anonymised, except where retention is required by Kenyan law
• Aggregated and anonymised data may be retained indefinitely

8. Data Breach Notification

In the event of a personal data breach affecting Customer Data, we will notify the Customer without undue delay and provide information reasonably required for the Customer to meet its own obligations under the Data Protection Act, 2019.

9. International Transfers

Where Customer Data is transferred outside Kenya, we ensure appropriate safeguards are in place in accordance with the Data Protection Act, 2019.

10. Contact

For data protection inquiries: